Operate

CLI reference

Run gmonk <command> --help for full options. With the Docker deployment, prefix with docker compose run --rm gmonk (or alias it).

Setup & protect

Command	What it does
`gmonk setup`	Start here. Guided wizard: pick what to protect (database / files & shell / both). Flag-driven for CI (`--database`/`--files`/`--all`).
`gmonk protect --backend-ref <ENV>`	Run the wire proxy in front of your DB with undo capture on (`--guarantee`, `--tls-*`, `--listen`, `--gc-every`).
`gmonk enforce --agent-role <role>`	Revoke the agent's direct DB access so gmonk is the only way in (Postgres & MySQL).
`gmonk demo`	Run the whole story end-to-end against a throwaway table.
`gmonk migrate`	Create/update gmonk's schema (idempotent).

Command	What it does
`gmonk runs`	List runs, grouped by project.
`gmonk show <run>`	Render a run's action tree.
`gmonk reverse-plan <run>`	Preview an undo with a live drift check (read-only).
`gmonk reverse-run <run>`	Apply the undo (`--dry-run`, `--force`, `--only`).
`gmonk excise <run> <seq…>`	Undo one action plus exactly its causal dependents.
`gmonk rrr <run>`	Rewind-repair-replay: fix a bad step, replay the good downstream work.
`gmonk state-at` / `gmonk deps <run>`	Point-in-time reconstruction · dependency graph / blast radius.
`gmonk recoverability <run>` / `pin`	Recoverability status · exempt captures from GC.
`gmonk web`	Serve the review UI (SSO/token/RBAC-aware).
`gmonk approvals` / `approve` / `deny`	List and decide held actions.

Command	What it does
`gmonk protect-db` / `unprotect-db`	Bring a target under WAL/trigger capture · clean teardown.
`gmonk wal-drain [--watch <s>]`	Drain registered targets' replication slots into the store.
`gmonk sql-install` / `sql-uninstall <table>`	Add/remove a capture trigger on an owned table.
`gmonk wal-setup` / `wal-protect` / `wal-teardown`	Lower-level WAL primitives (per slot / per table).
`gmonk coverage-report --target-ref <ENV>`	Pre-flight: classify each table reversible / limited.

Command	What it does
`gmonk install-hook` / `uninstall-hook`	Wire gmonk into Claude Code (fast HTTP hook by default; `--exec` for spawn).
`gmonk run -- <server…>`	MCP gateway: capture an MCP-native agent's tool calls.
`gmonk gc [--schedule --every 24h] [--delete]`	Mark-sweep unreferenced before-images.
`gmonk users add\|list\|disable\|enable\|role`	Manage review-UI accounts & roles.
`gmonk slack-listen` / `sso-check`	Run the Slack Socket-Mode listener · validate SSO/OIDC config.